---
id: ML-74
title: Sanitize markdown HTML output in Notes component
status: Done
assignee: []
created_date: "2026-04-20 08:56"
labels: []
dependencies: []
references:
  - "https://github.com/cloud8421/music_library/issues/101"
priority: low
---

## Description

<!-- SECTION:DESCRIPTION:BEGIN -->

_GitHub: created 2026-03-07 · updated 2026-03-07 · closed 2026-03-07_

`lib/music_library_web/components/notes.ex:162` renders user-authored markdown via `Earmark.as_html!/2` + `raw()` without HTML sanitization.

Currently single-user so self-XSS only, but should sanitize for defense in depth.

<!-- SECTION:DESCRIPTION:END -->